wolfHSM/.github/workflows/static-analysis.yml at main · wolfSSL/wolfHSM · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
name: Static Analysis

on:
  pull_request:
    branches: [ main, master ]
  push:
    branches: [ main, master ]

permissions:
  contents: read

jobs:
  cppcheck:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Checkout wolfssl
      uses: actions/checkout@v4
      with:
        repository: wolfssl/wolfssl
        ref: v5.6.4-stable
        path: wolfssl

    - name: Install cppcheck
      run: |
        sudo apt-get update
        sudo apt-get install -y cppcheck

    - name: Run cppcheck
      id: cppcheck
      continue-on-error: true
      run: |
        chmod +x tools/static-analysis/run_cppcheck.sh
        tools/static-analysis/run_cppcheck.sh

    - name: Display errors and warnings
      if: always()
      run: |
        if [ -f tools/static-analysis/reports/cppcheck_summary.txt ]; then
          ERROR_COUNT=$(grep -c "error:" tools/static-analysis/reports/cppcheck_summary.txt 2>/dev/null) || ERROR_COUNT=0
          WARNING_COUNT=$(grep -c "warning:" tools/static-analysis/reports/cppcheck_summary.txt 2>/dev/null) || WARNING_COUNT=0
          STYLE_COUNT=$(grep -c "style:" tools/static-analysis/reports/cppcheck_summary.txt 2>/dev/null) || STYLE_COUNT=0

          echo "## Static Analysis Summary"
          echo "- Errors: $ERROR_COUNT"
          echo "- Warnings: $WARNING_COUNT"
          echo "- Style issues: $STYLE_COUNT (informational only)"

          if [ "$ERROR_COUNT" -gt 0 ] || [ "$WARNING_COUNT" -gt 0 ]; then
            echo ""
            echo "### Issues that must be fixed:"
            echo ""
            # Show only errors and warnings, not style issues
            grep -E "(error|warning):" tools/static-analysis/reports/cppcheck_summary.txt || true
          fi
        else
          echo "⚠️ No cppcheck summary file found"
        fi

    - name: Fail if issues found
      if: steps.cppcheck.outcome == 'failure'
      run: |
        echo "❌ Static analysis failed - errors or warnings were found"
        exit 1

  scan-build:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout wolfHSM
      uses: actions/checkout@v4
      with:
        path: wolfHSM

    - name: Checkout wolfssl
      uses: actions/checkout@v4
      with:
        repository: wolfssl/wolfssl
        path: wolfssl

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y clang build-essential clang-tools

    - name: Run scan-build
      id: scan-build
      run:
        cd wolfHSM && make scan

    - name: Fail if scan-build issues found
      if: steps.scan-build.outcome == 'failure'
      run: |
        echo "❌ scan-build analysis failed - errors or warnings were found"
        exit 1

  clang-tidy:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Checkout wolfssl
      uses: actions/checkout@v4
      with:
        repository: wolfssl/wolfssl
        path: wolfssl

    - name: Install dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y clang clang-tidy build-essential

    - name: Run clang-tidy
      id: clang-tidy
      run: |
        chmod +x tools/static-analysis/run_clang_tidy_make.sh
        chmod +x tools/static-analysis/clang-tidy-builder.sh
        tools/static-analysis/run_clang_tidy_make.sh

    - name: Display errors and warnings
      if: always()
      run: |
        if [ -f tools/static-analysis/reports/clang_tidy_summary.txt ]; then
          # Count issues from clang-tidy output
          ERROR_COUNT=$(grep -c "error:" tools/static-analysis/reports/clang_tidy_summary.txt 2>/dev/null) || ERROR_COUNT=0
          WARNING_COUNT=$(grep -c "warning:" tools/static-analysis/reports/clang_tidy_summary.txt 2>/dev/null) || WARNING_COUNT=0

          echo "## Clang-Tidy Analysis Summary"
          echo "- Errors: $ERROR_COUNT"
          echo "- Warnings: $WARNING_COUNT"

          if [ "$ERROR_COUNT" -gt 0 ] || [ "$WARNING_COUNT" -gt 0 ]; then
            echo ""
            echo "### Issues found:"
            echo ""
            # Show first 50 issues to avoid overwhelming output
            head -50 tools/static-analysis/reports/clang_tidy_summary.txt
            TOTAL_ISSUES=$((ERROR_COUNT + WARNING_COUNT))
            if [ "$TOTAL_ISSUES" -gt 50 ]; then
              echo ""
              echo "... and $((TOTAL_ISSUES - 50)) more issues. See full report for details."
            fi
          fi
        else
          echo "⚠️ No clang-tidy summary file found"
        fi

    - name: Fail if issues found
      if: steps.clang-tidy.outcome == 'failure'
      run: |
        echo "❌ Clang-tidy analysis failed - errors or warnings were found"
        exit 1